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Abstract 

We prove a tight quantum query lower bound Q(n k '( k+1 >) for the problem of deciding 
whether there exist k numbers among n that sum up to a prescribed number, provided that 
the alphabet size is sufficiently large. 

This is an extended and simplified version of an earlier preprint of one of the authors [7 . 

1 Introduction 

Two main techniques for proving lower bounds on quantum query complexity are the polynomial 
method [6] developed by Beals et al. in 1998, and the adversary method [2] developed by 
Ambainis in 2000. Both techniques are incomparable. There are functions with adversary 
bound strictly larger than polynomial degree [3], as well as functions with the reverse relation. 

One of the examples of the reverse relation is exhibited by the element distinctness function. 
The input to the function is a string of length n of symbols in an alphabet of size q, i.e., 
x = (xi) G [q] n . We use notation [q] to denote the set {1, ...,q}. The element distinctness 
function evaluates to if all symbols in the input string are pairwise distinct, and to 1 otherwise. 

The quantum query complexity of element distinctness is 0(n 2 / 3 ) with the algorithm given 
by Ambainis [5j. The tight lower bounds were given by Aaronson and Shi pQ, Kutin [T3] and 
Ambainis [4J using the polynomial method. 

The adversary bound, however, fails for this function. The reason is that the function has 
1-certificate complexity 2, and the so-called certificate complexity barrier |17t ITS] implies that 
for any function with 1-certificate complexity bounded by a constant, the adversary method 
fails to achieve anything better than Q(y/n). 

In 2006 a stronger version of the adversary bound was developed by Hoyer et al. |12| . This 
is the negative-weight adversary lower bound defined in Section [2j Later it was proved to be 
optimal by Reichardt et al. [151 E] • Although the negative- weight adversary lower bound is 
known to be tight, it has almost never been used to prove lower bounds for explicit functions. 
Vast majority of lower bounds by the adversary method used the old positive-weight version 
of this method. But since the only competing polynomial method is known to be non-tight, a 
better understanding of the negative-weight adversary method would be very beneficial. In the 
sequel, we consider the negative-weight adversary bound only, and we will omit the adjective 
"negative- weight" . 

In this paper we use the adversary method to prove a lower bound for the following variant 
of the knapsack packing problem. Let G be a finite Abelian group, and t E G be its arbitrary 
element. For a positive integer k, the k-sum problem consists in deciding whether the input 
string xi, . . . ,x n G G contains a subset of k elements that sums up to t. We assume that k is 
an arbitrary but fixed constant. The main result of the paper is the following 
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Theorem 1. For a fixed k, the quantum query complexity of the k-sum problem is fl(n k ^ k+1 ^) 
provided that \G\ > n k . 

Clearly, the 1-certificate complexity of the /c-sum problem is k, hence, it is also subject to 
the certificate complexity barrier. 

The result of Theorem [JJ is tight thanks to the quantum algorithm based on quantum walks 
on the Johnson graph [5]. This algorithm was first designed to solve the ^-distinctness problem. 
This problem asks for detecting whether the input string x G [q] n contains k elements that are 
all equal. Soon enough it was realized that the same algorithm works for any function with 1- 
certificate complexity k [TT], in particular, for the A;-sum problem. The question of the tightness 
of this algorithm remained open for a long time. It was known to be tight for k = 2 due to the 
lower bound for the element distinctness problem. Now we know that it is not optimal for the 
/c-distinctness problem if k > 2 [8]. However, Theorem [JJ shows that, for every k, quantum walk 
on the Johnson graph is optimal for some functions with 1-certificate complexity k. Finally, we 
note that the fc-sum problem is also interesting because of its applications in quantum Merkle 
puzzles [91 [13]. 

Actually, we get Theorem [1] as a special case of a more general result we are about to 
describe. The following is a special case of a well-studied combinatorial object: 

Definition 2. Assume T is a subset of [q] k of size q k_1 . We say that T is an orthogonal array 
of length k iff, for every index i G [k] and for every vector x%,..., Xj+i, . . . , Xk G [q], there 
exists exactly one X{ G [q] such that (x%, . . . , x^) G T. 

For x = (xi) G [q] n and S C [n] let xs denote the projection of x on S, i.e., the vector 
(x Sl , • • • , x S( ) where s\, . . . ,S£ are the elements of S in the increasing order. 

Assume each subset S of [n] of size k is equipped with an orthogonal array T$. The k- 
orthogonal array problem consists in finding an element of any of the orthogonal arrays in the 
input string. More precisely, the input x G [q] n evaluates to 1 iff there exists S C [n] of size k 
such that xs G Tg. 

Consider the following two examples: 

Example 3. Let G be a commutative group with q elements and i e G. T = {xG G k : 
Ym=i x i = t} i s an orthogonal array of length k. This choice corresponds to the /c-sum problem 
of Theorem [TJ 

Example 4. T = {x G [q] 2 : x\ = £2} is an orthogonal array of length 2. This corresponds to 
the element distinctness problem from [7]. 

Theorem 5. For a fixed k and any choice of the orthogonal arrays T$, the quantum query 
complexity of the k-orthogonal array problem is Q,(n k ^ k+l ^) provided that q > n k . The constant 
behind big-Omega depends on k, but not on n, q, or the choice ofTg. 

The orthogonal array condition specifies that even if an algorithm has queried k — 1 elements 
out of any A:-tuple, it has the same information whether this fc-tuple is a 1-certificate as if it 
has queried no elements out of it. Because of this, the search for a /c-tuple as a whole entity 
is the best the quantum algorithm can do. Our proof of Theorem [5] is a formalization of this 
intuition. 

Let us elaborate on the requirement on the size of the alphabet. It is easy to see that some 
requirement is necessary. Indeed, the fc-sum problem can be solved in 0(y/n) queries if the size 
of G is O(l), using the Grover search to find up to k copies of every element of G in the input 
string, and trying to construct t out of what is found. In some cases, e.g., when t is the identity 
element and k equals the order of the group, the problem becomes trivial if n is large enough. 
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The requirement on the size of the alphabet for the element distinctness problem is a subtle 
issue. The lower bounds by Aaronson and Shi |Tj and Kutin [J3] require the size of the alphabet 
to be at least f2(n 2 ) that is the same that gives Theorem [SJ However, later Ambainis [4] showed 
that the lower bound remains the same even if one allows the alphabet of size n. Reducing the 
alphabet size in Theorem [5] is one of our open problems. 



2 Adversary Lower Bound 

In the paper we are interested in the quantum query complexity of solving the orthogonal array 
problem. For the definitions and main properties of quantum query complexity refer to, e.g., 
Ref. [10]. For the purposes of our paper, it is enough with the definition of the adversary bound 
we give in this section. 

Compared to the original formulation of the negative adversary bound |12| . our formulation 
has two differences. Firstly, in order to simplify notations we call an adversary matrix a matrix 
with rows labeled by positive inputs, and the columns by the negative ones. It is a quarter of 
the original adversary matrix that completely specifies the latter. Secondly, due to technical 
reasons, we allow several rows to be labeled by the same positive input. All this is captured by 
the following definition and theorem. 

Definition 6. Let / be a function /: T> — > {0, 1} with domain T> C [q] n . Let T> be a set of pairs 
(x, a) with the property that the first element of each pair belongs to V, and T>i = {(x,a) G 
T> : f{x) = i} for i £ {0, 1}. An adversary matrix for the function / is a non-zero real T>\ x Dq 
matrix T. And, for i € [n], let Aj denote the T>\ x T>q matrix defined by 



AiI(x,o),(y,6)] 



0, X{ — yi, 

1, otherwise. 



Theorem 7 (Adversary bound [32]). In the notation of Definition® Qi(f) = r2(Adv ± (/)) J 
where 

Adv ± (/) = sup H (1) 

r max ign ||T o Aj|| 

with the maximization over all adversary matrices for f , \\ ■ \\ is the spectral norm, and 
is the quantum query complexity of f . 

Proof. In the original negative- weight adversary bound paper |12| . Eq. ([TJ is proven when V 
is a real symmetric D xP matrix with the property = if f(x) = f(y), and Aj are 

modified accordingly. We describe a reduction from the adversary matrix in our definition, T, 
to the adversary matrix V in the definition of |12j . Also, let A^ be the PxP matrix with 
A^[x,y] = 1 if Xi yi, and 0, otherwise. 
At first, define T as 

'0 r* 
,r o 

Note that ||r|| = ||r||, and the spectrum of T is symmetric. Also, for all i, ||roAj|| = ||roAj||, 
where Aj is defined similarly to T. 

Let 5 = (S Xta ) be the normalized eigenvalue ||r|| eigenvector of T. For all x,y G T>, let: 

s ' x = I Yj and r 'I x 'fl = ^y £ 8x,a$y,bTl(x,a),(y,b)] . 

y a:(x,a)&V X V a:(x,a)eV 

b:(y,b)eV 
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Then it is easy to see that 6' = (8' x ) satisfies ||<5'|| = 1 and (5')*F'5' = 5*F5 = ||r||, hence, 

||r'|| > ||r||. 

And vice versa, if e' is such that ||e'|| = 1 and (e')*(V oA'^e' = \\F'o A-||, let £ x>a = 5 Xja e' x /5 x . 
Again, ||e|| = 1 and ^(foA,^ (e')*(F' o A'Je' , hence, ||r' o A^|| < ||T o Aj|| ='||roA;||. 
This means that V provides at least as good adversary lower bound as T. □ 



3 Proof 

In this section we prove Theorem [5] using the adversary lower bound, Theorem [7J The idea 
of our construction is to embed the adversary matrix F into a slightly larger matrix F with 
additional columns. Then F o Aj is a submatrix of F o Aj, hence, ||T o AJ| < ||T o Aj||. (In 
this section we use Aj to denote all matrices defined like in Definition [6l with the size and the 
labels of the rows and columns clear from the context.) It remains to prove that ||r|| is large, 
and that ||r|| is not much smaller than ||r||. 

The proof is organized as follows. In Section 13.11 we define F in dependence on parameters 
a m , in Section 13.21 we analyze its norm, in Sections 13.31 and 13.41 we calculate ||T o Aj||, in 
Section 13.51 we optimize a m s, and, finally, in Section 13.61 we prove that the norm of the true 
adversary matrix F is not much smaller than the norm of T. 

3.1 Adversary matrix 

Matrix F consists of (?) matrices G 8u .„ i8k stacked one on another for all possible choices of 
S = {si, ...,s k }c [n\: 

G\fl,...,k ^ 

Y — Ci i 2 v ..,fc-i,fc+i 

— k+l,n— k+2,...,n / 

Each Gs is a q n ~ 1 x q n matrix with rows indexed by inputs (x\, . . . , x n ) G [q] n such that xs G Ts, 
and columns indexed by all possible inputs (yi, . . . , y n ) £ [q] n . 

We say a column with index y is illegal if ys G Ts for some S C [n]. After removing all 
illegal columns, Gs will represent the part of F with the rows indexed by the inputs having an 
element of the orthogonal array on S. Note that some positive inputs appear more than once 
in r. More specifically, an input x appears as many times as many elements of the orthogonal 
arrays it contains. 

This construction may seem faulty, because there are elements of [q] n that are used as labels 
of both rows and columns in F, and hence, it is trivial to construct a matrix F such that the 
value in ([1]) is arbitrarily large. But we design F in a specifically restrictive way so that it still 
is a good adversary matrix after the illegal columns are removed. 

Let J q be the q x q all-ones matrix. Assume eo, • • • , eg-i is an orthonormal eigenbasis of 
J q with eo = l/y / g(l, . . . , 1) being the eigenvalue q eigenvector. Consider the vectors of the 
following form: 

v = e vi g) e V2 (8) • • • (8) e„ n , (3) 

where G {0, . . . , q — 1}. These are eigenvectors of the Hamming Association Scheme on [q] n . 
For a vector v from 0, the weight \v\ is defined as the number of non-zero entries in (yx, . . . , v n ). 

(n) 

Let El , for k = 0, . . . ,n, be the orthogonal projector on the space spanned by the vectors 
from ([3]) having weight k. These are the projectors on the eigenspaces of the association scheme. 
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Let us denote Ei = for i = 0, 1. These are q x q matrices. All entries of Eq are equal to 
1/q, and the entries of E\ are given by 



EAx, 



1-1/q, x = y; 
-1/q, x^y. 



Elements of S in Gs should be treated differently from the rest of the elements. For them, 
we define a q k ~ 1 x q k matrix Fg- It has rows labeled by the elements of T$ and columns by the 
elements of [q] , and is defined as follows. 

Definition 8. Let 

fc-i 



i=0 w=e„ 1 ®---(g)e« i . 

be the projector onto the subspace spanned by the vectors of less than maximal weight. Let F$ 

(k) 

be yjq times the sub- matrix of E^ consisting of only the rows from T$. 
Finally, we define r as in ([2} with Gs defined by 

n—k 

Gs=Yl a ™ p s ® E ™~ k) > ( 4 ) 

m=0 

where F$ acts on the elements in S and E m acts on the remaining n — k elements. Coefficients 
a m will be specified later. 

3.2 Norm of f 

Lemma 9. Let T be like in with Gs defined like in Q). Then 

(a) ||f || = n(a n k / 2 ), 

(b) ||f || = 0(max m a m n fc / 2 ). 

(k) 

Proof. Fix a subset S and denote T = Ts and F = Fs- Recall that E)J is the sum of uu* over 

(k) 

all u = e Ul (8) • • • ® e Uft with at least one Uj equal to 0, and F is the restriction of E^ to the 
rows in T. 

For u = e Ul ®- ■ - ® e Uk and £ such that ug = 0, let u^' denote the ^fq multiple of u restricted 
to the elements in T. The reason for the superscript is that we consider the following process 
of obtaining we treat T as [g] fc_1 by erasing the ^-th element in any string of T, then 
coincides on this set with u with the £-th term removed. 

In this notation, the contribution from uu* to F equals u^ u ^u* , where t u is any position in 
u containing eo- In general, we do not know how u^s relate for different I. However, we know 
that, for a fixed £, they are all orthogonal; and for any £, (e® fe )^ is the vector g fc-1 (l, . . . , 1). 

Let us start with proving (a). We estimate ||r|| from below as w*Tw' , where w and w' are 
unit vectors with all elements equal. In other words, ||r|| is at least the sum of all its entries 



divided by y (1)Q 2n 1 - I n order to estimate the sum of the entries of T, we rewrite (HD as 

G s = aoe® {n - 1 \e® n y + Y / a lvl (u^®v)(u®vy , (5) 
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where the summation is over all u and v such that at least one of them contains an element 
different from cq. The sum of all entries in the first term of ([5]) is aoq n ^ 1 ^ 2 . The sum of each 
column in each of (u^ u ' ®v)(u® v)* is zero because at least one of u^ u ^ or v sums up to zero. 

By summing over all (?) choices of S, we get that ||r|| > a y^)" = n{a n k ^). 

vS^'U*. Here {Ui} is an 



In order to prove (b), express F$ as Yli=i with Fg = Yl u 



arbitrary decomposition of all u such that Ui contains only u with eo in the £-th position. Define 
G$ as in (@J) with F s replaced by F s e) , and as in © with G s replaced by tif . 
Since all u^s are orthogonal for a fixed £, we get that 



( G M)* G M = af vl (u®v)(u®v)* 

U€lUi,V 

thus ||(G^)*G^|| = max m a^. By the triangle inequality, 



n 

1^1 maxa, 



Since T = X^=i another application of the triangle inequality finishes the proof of (b). □ 



3.3 Action of A x 

The adversary matrix is symmetric in all input variables and hence it suffices to only consider 
the entry-wise multiplication by Aj.. Precise calculation of ||T o Ai|| is very tedious, but one 
can get an asymptotically tight bound using the following trick. Instead of computing T o Ai 

directly, we arbitrarily map V i— h F\ such that Ti o Ai = r o Ai, and use the inequality 
II Ti o Ai|| < 2 1 1 r*i_ 1 1 that holds thanks to 72(Ai) < 2 [15]. In other words, we change arbitrarily 
the entries with x\ = y\. We use the mapping 

E ^E , El £h-E , lAo, (6) 

The projector is mapped by A i as 

E^^I-E^^Eo^Ef^ . 

It follows that 

F\ — > e <8> E x — u u > ( 7 ) 

«=e ui <g>— ®e Ufc 
uo=0,\u\=k—l 

where vP~' is defined like in the proof of Lemma [9l 



3.4 Norm of I\ 

Lemma 10. Let V be like in with Gt defined like in Oj, and map V \—h Y\ and Gt >— V 
(Gt)i using (0|) and Then \\Ti\\ = 0(max m (m&x(a m mS k ~ 1 ^ 2 , (a m — a m+ i)n k / 2 ))). 

Proof. We have ||ri|| 2 = ||r*ri|| = \\^2 s (Gs)l(Gs)i\\- Decompose the set of all possible k- 
tuples of indices into <Si U 52, where S\ are fc-tuples containing 1 and 52 are ^-tuples that 
don't contain 1. We upper-bound the contribution of S\ to ||ri|| 2 by maxma^™^ 1 ) and the 
contribution of 52 by max m (a m — a m+ i) 2 A:( ra ^ 1 ) , and apply the triangle inequality. 
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Let v = e Vl ® • • • <g) e„ n with \v\ = m + k — 1, and let S £ S\. Then, by ((7D, 

fG ) w = I amt,(1) ' Vl = and I 1 ' 5 ' = - 1, 
\ 0, otherwise. 

Here = e V2 ® • • • (8) et, n is u with the first term removed and t>s = ® s es e ^s • 

For different u, these are orthogonal vectors, and hence v is an eigenvector of (Gs)i(Gs)i 

of eigenvalue if Ui =0 and |u<j| = & — 1, and of eigenvalue otherwise. For every v with 

v i = and |v| = m + k — 1, there are {"^t-i 1 ) se ^ s S £ S\ such that (Gs)iv / 0. Thus, the 

contribution of S± is as claimed. 

Now consider an S £ S2, that means 1 S. 

n—k 

GS = a ™ F S ® 

m=0 

n— fc 

= £ a m F s ® (So ® ^T*^ + Si ® £fcf _1) ) 

m=0 
n— fc 

m=0 
n— fc 

= (G s )i = ^2(a m -a m+1 )F s ®E ®Efr- k -V . 

m=0 

Therefore (G?s)i is of the same form as Gg, but with coefficients {cn m — ct-m+i ) instead of ot m 
and on one dimension less. We get the required estimate from Lemma E(b). 

Since k = 0(1), we get the claimed bound. □ 



3.5 Optimization of a m 

To maximize the adversary bound, we maximize ||r|| while keeping ||ri|| = 0(1). That means, 
we choose the coefficients (a m ) to maximize aon k ^ 2 (Lemma [9|) so that, for every m, a m < 
m (l-*)/ 2 anc i Qm < a m+ i + n~ k l 2 (Lemma [T0|) . 

For every r 6 [n], «o < a r + m~ k l 2 < r'- 1- '^/ 2 + m~ k l 2 . The expression on the right-hand 
side achieves its minimum, up to a constant, ao = 2 n k ( 1 ~ k ^( 2 ( k+1 ^ for r = n k /( k + 1 ). This 
corresponds to the following solution: 

« m = max{2-^ Tiy) 0)nW) (8) 
With this choice of a m , ||f || = fi(a ^ /2 ) = tt(n k /( k+ ^). 

3.6 Constructing T from T 

The matrix T gives us the desired ratio of norms of T and T o Aj. Unfortunately, T cannot 
directly be used as an adversary matrix, because it contains illegal columns y with f(y) = 1, 
that is, y that contain an element of the orthogonal array on S C [n] : \S\ = k, i.e., yg £ Tg. 
We show that after removing the illegal columns it is still good enough. 

Lemma 11. Let T be the sub-matrix ofT with the illegal columns removed. Then \\T o Ai|| < 
||roAi||, and \\T\\ is still tt(aon k / 2 ) whenq>n k . 
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Proof. We estimate ||r|| from below by w*Tw' using unit vectors w,w' with all elements equal. 
Recall Equation ©: 

G T = aoe^-^ie^)* + £a H (u^ ®v){u® v)* , 

u,v 

where the summation is over all u and v such that at least one of them contains an element 
different from eo- The sum of each column in each of (u^ u > (g) v)(u (g) v)* still is zero because at 
least one of or v sums up to zero. Therefore the contribution of the sum is zero regardless 
of which columns have been removed. 

By summing over all (?) choices of S, we get 

||r|| > w*Tw' = ^/Q«o (eT)lw' , 

where sl denotes the sub-vector of e restricted to L, and L is the set of legal columns. Since 
both eo and w' are unit vectors with all elements equal, and w' is supported on L, {e® n )* L w' = 

Let us estimate the fraction of legal columns. The probability that a uniformly random input 
y € [q] n contains an orthogonal array at any given /c-tuple S is K By the union bound, the 
probability that there exists such S is at most (?J ^ . Therefore the probability that a random 
column is legal is ^ > 1 — (?J-, which is when q>n k . □ 

Thus, with the choice of (a m ) from ©, we have Adv ± (/) = n(a n k / 2 ) = n(n k / ( - k+1 ^). This 
finishes the proof of Theorem 

4 Open problems 

Our technique relies crucially on the n k lower bound on the alphabet size. Can one relax this 
bound in some special cases? For example, element distinctness is nontrivial when q > n, but 
our lower bound only holds for q > n 2 . 

A tight Q(n 2 / 3 ) lower bound for element distinctness was originally proved by the polynomial 
method [TJ by reduction via the collision problem. The ^-collision problem is to decide whether 
a given function is 1 : 1 or k : 1, provided that it is of one of the two types. One can 
use an algorithm for element distinctness to solve the 2-collision problem, and thus the tight 
^(n 1 / 3 ) lower bound for collision in [1] implies a tight lower bound for element distinctness. 
Unfortunately, the reduction doesn't go in both directions and hence our result doesn't imply 
any nontrivial adversary bound for /c-collision. The simpler non-negative adversary bound is 
limited to 0(1) due to the property testing barrier. Roughly speaking, if every 0-input differs 
from every 1-input in at least an e-fraction of the input, the non- negative adversary bound is 
limited by O(-). How does an explicit negative adversary matrix for an w(l) lower bound look 
like? 

The recent learning graph-based algorithm for ^-distinctness [8j uses quan- 
tum queries, which is less than 0(n k ^ k+1 ^) but more than the f2(ra 2 / 3 ) lower bound by reduction 
from 2-distinctness. ^-distinctness is easier than the fc-sum problem considered in our paper 
because one can obtain nontrivial information about the solution from partial solutions, i.e., 
from ^-tuples of equal numbers for £ < k. Can one use our technique to prove an cj(re 2 / 3 ) lower 
bound for ^-distinctness? 

The fc-sum problem is very structured in the sense that all /c-tuples of the input variables, 
and all possible values seen on a (k — l)-tuple, are equal with respect to the function. The 
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symmetry of this problem helped us to design a symmetric adversary matrix. The nonnegative 
adversary bound gives nontrivial lower bounds for most problems, by simply putting most of 
the weight on hard-to-distinguish input pairs, regardless of whether the problem is symmetric 
or not. Can one use our technique to improve the best known lower bounds for some non- 
symmetric problems, for example, to prove an u(y/n) lower bound for graph collision, u{n) for 
triangle finding, or cj(?i 3 / 2 ) for verification of matrix products? 
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